Add initial implementation of PolinRider malware scanner

- Introduced core files including Dockerfile, action.yml, and entry point script (bin/polinrider.js) for the PolinRider malware scanner.
- Created configuration files: .env.example, .gitignore, and .npmrc for environment setup and dependency management.
- Added CI workflows for testing, building, and releasing the action, along with examples for usage in GitHub Actions.
- Implemented a README.md to provide documentation on usage, features, and setup instructions.
- Included necessary scripts for building the action and handling security measures during execution.
- Established a structured directory for reports and workspace management within Docker.
- Ensured all files are set up for a secure and efficient scanning process of GitHub repositories for PolinRider malware.

Dockerfile

@@ -0,0 +1,39 @@
+FROM node:20-slim
+
+# Install git, gh CLI, bash, curl, ca-certs
+RUN apt-get update && apt-get install -y \
+    git \
+    curl \
+    ca-certificates \
+    gnupg \
+    --no-install-recommends \
+    && mkdir -p /etc/apt/keyrings \
+    && curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
+       | gpg --dearmor -o /etc/apt/keyrings/githubcli-archive-keyring.gpg \
+    && echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \
+       > /etc/apt/sources.list.d/github-cli.list \
+    && apt-get update \
+    && apt-get install -y gh \
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/*
+
+# Create non-root user
+RUN groupadd --gid 1001 scanner \
+    && useradd --uid 1001 --gid scanner --shell /bin/bash --create-home scanner
+
+# App directory owned by non-root user
+WORKDIR /app
+COPY --chown=scanner:scanner . .
+
+# Install Node deps. .npmrc sets ignore-scripts=true, so no dependency lifecycle
+# scripts run during install (defense-in-depth). --ignore-scripts is explicit too.
+RUN npm ci --omit=dev --ignore-scripts
+
+# Repos will be cloned here at runtime (tmpfs or volume)
+RUN mkdir -p /workspace && chown scanner:scanner /workspace
+
+# Switch to non-root
+USER scanner
+
+# Run via the hardened launcher (applies --disallow-code-generation-from-strings).
+ENTRYPOINT ["node", "bin/polinrider.js"]